CVE-2023-6831: lfprojects mlflow Path Traversal: '\..\filename'
CVSS: 8.1v3.0HighModified
AliasesGHSA-554w-xh4j-8w64BIT-mlflow-2023-6831PYSEC-2023-253
Published 15-12-2023Last modified 02-08-2024
Vulnerability summary
CVE-2023-6831 is a high (CVSS 8.1) Path Traversal: '\..\filename' vulnerability in lfprojects mlflow. EPSS estimates a 3.29% chance of exploitation in the next 30 days, higher than 88.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.0 (CVE.org)EPSS score
3.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 15-12-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.1Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HSourcesAll 2 agree
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
High 8.1Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HSourcesAll 2 agree
- NVDNIST8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
3.29%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.29% on 21-09-2026
21-09-202621-10-2026
EPSS score3.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-29Path Traversal: '\..\filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Lfprojects1 product
- mlflow< 2.9.2
Mlflow1 product
- mlflow/mlflow≥ unspecified, < 2.9.2
PyPI1 product
- mlflow< 1da75dfcecd4d169e34809ade55748384e8af6c1 | < 2.9.2
3 vendors · 3 products
References
6 links
- github.com/mlflow/mlflowPACKAGE